ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Risk acceptability criteria are the part of an ISO 14971:2019 risk management file that is written before any hazard is analysed and read by the reviewer before anything else — because every later judgement in the file is measured against them. Clause 4.2 requires top management to define and document a policy for establishing criteria for risk acceptability; clause 4.4 requires the risk management plan for each device to state the criteria, based on that policy, including criteria for accepting risks when the probability of occurrence of harm cannot be estimated; clause 6 evaluates every estimated risk against them; and clause 8 evaluates the overall residual risk by the method and criteria the plan defines.
The criteria are the manufacturer’s to set, and ISO/TR 24971:2020 explains what a defensible policy looks like: derived from the applicable regulations and the state of the art, covering the whole range of severities and probabilities, and not so permissive that the benefit-risk analysis never has to be written. This guide sets out what the policy and the criteria must contain, how the severity and probability scales are built, how the matrix is drawn and where the acceptability line goes, the two-part probability estimate ISO/TR 24971 recommends, what EU MDR changes, and the errors that reviewers find most often.
| Level | Clause | Owner | Content |
|---|---|---|---|
| Policy for establishing criteria | 4.2 | Top management | How the organisation decides what is acceptable: regulatory basis, state of the art, the approach to as-far-as-possible reduction, how benefit is considered, how the criteria are reviewed |
| Criteria for risk acceptability | 4.4 c) | Risk management plan, per device | The severity and probability scales, the acceptability regions, the rule for risks whose probability cannot be estimated, the method and criteria for overall residual risk |
| Risk matrix | 5.5 / 6 (tool, not a requirement) | Risk management team | The visual application of the criteria: severity across, probability down, regions marked |
The matrix is the most visible of the three and the least important: the standard does not require one, and a matrix without a documented policy behind it is what reviewers challenge. Our guide to the ISO 14971 risk management plan covers the plan the criteria live in.
| Level | Typical descriptor | Example harm |
|---|---|---|
| Negligible | Inconvenience or temporary discomfort | Transient skin irritation; delay in a non-critical result |
| Minor | Temporary injury or impairment not requiring professional medical intervention | Minor bruising; brief symptom recurrence |
| Serious | Injury or impairment requiring professional medical intervention | Infection requiring treatment; fracture |
| Critical | Permanent impairment or life-threatening injury | Loss of function; organ damage |
| Catastrophic | Death | Death |
Five levels is the common choice; three is defensible for simple devices. The descriptors must be about harm to people (or property or the environment, per 3.3), not about the device — “device failure” is not a severity. Definitions of serious injury in the applicable regulation (MDR Article 2(65) serious incident; FDA 21 CFR 803.3) are the natural anchors for the upper levels.
| Level | Qualitative descriptor | Semi-quantitative example (per use or per device-year) |
|---|---|---|
| Frequent | Likely to occur often in the life of the device | ≥ 10⁻³ |
| Probable | Will occur several times | 10⁻⁴ to < 10⁻³ |
| Occasional | Likely to occur sometime | 10⁻⁵ to < 10⁻⁴ |
| Remote | Unlikely but possible | 10⁻⁶ to < 10⁻⁵ |
| Improbable | So unlikely it can be assumed it will not occur | < 10⁻⁶ |
ISO/TR 24971 recommends estimating probability in two parts: P1, the probability that the hazardous situation occurs, and P2, the probability that the hazardous situation leads to harm; the probability of harm is their product. The split matters because risk controls act on different parts — a design change reduces P1, a protective measure or information for safety reduces P2 — and because P2 is where clinical knowledge enters.
The plan states the unit (per use, per device, per year) and the data sources — field data, literature, similar devices, testing, expert judgement — and when probability cannot be estimated, the plan’s rule applies: commonly, evaluate on severity alone and treat the risk as requiring control unless a defensible upper bound exists.
| Negligible | Minor | Serious | Critical | Catastrophic | |
|---|---|---|---|---|---|
| Frequent | Acceptable* | Not acceptable | Not acceptable | Not acceptable | Not acceptable |
| Probable | Acceptable | Acceptable* | Not acceptable | Not acceptable | Not acceptable |
| Occasional | Acceptable | Acceptable | Acceptable* | Not acceptable | Not acceptable |
| Remote | Acceptable | Acceptable | Acceptable | Acceptable* | Not acceptable |
| Improbable | Acceptable | Acceptable | Acceptable | Acceptable | Acceptable* |
An illustrative 5 × 5, not a recommendation; the asterisked cells are where many manufacturers place a middle region — acceptable only after risk control has been applied as far as possible and the residual risk is reviewed and documented. Two rules for the line.
Regulations set the floor: EU MDR requires all risks to be reduced as far as possible and to be acceptable when weighed against benefits, so a cell cannot be labelled acceptable in a way that excuses practicable reduction; EN ISO 14971:2019/A11:2021 Annex ZA records that the standard’s own “acceptable” language does not on its own satisfy MDR. And the line is device-specific: a life-sustaining device and a diagnostic accessory do not share a matrix, which is why the criteria are set in each plan rather than once for the company.
Clause 8 requires the plan to define a method and criteria for evaluating the overall residual risk, and clause 4.4 requires them in the plan. The matrix does not do this — it evaluates one risk at a time. ISO/TR 24971 describes approaches: reviewing the distribution of individual residual risks across the matrix, comparing the device with similar devices and the state of the art, expert review against the benefits of the intended use, and event-tree analysis of combinations. The plan names the approach and the acceptance rule; where the overall residual risk is not acceptable by it, a benefit-risk analysis follows. Our guide to benefit-risk analysis covers that step.
Our guide to the ISO 14971 risk management file covers the other places files break.
What are risk acceptability criteria under ISO 14971?
The rules, stated in each device’s risk management plan (clause 4.4) and derived from top management’s policy (clause 4.2), for deciding whether an estimated risk is acceptable: the severity and probability scales, the acceptable and unacceptable regions, the rule for risks whose probability cannot be estimated, and the method and criteria for overall residual risk (clause 8).
Does ISO 14971 require a risk matrix?
No. The matrix is a common tool for applying the criteria; the requirement is the policy and the documented criteria. A matrix without them is what reviewers challenge.
What is P1 × P2?
ISO/TR 24971’s two-part probability estimate: P1 is the probability that a hazardous situation occurs, P2 the probability that it leads to harm; their product is the probability of harm used in risk estimation. Risk controls typically act on one or the other.
How does EU MDR affect the criteria?
MDR Annex I requires risks to be reduced as far as possible and to be acceptable when weighed against benefits; an ‘acceptable’ region on the matrix cannot excuse practicable risk control, and EN ISO 14971:2019/A11:2021 Annex ZA records the deviation.
Who approves the criteria?
Top management defines the policy (4.2); the criteria for each device are set in the risk management plan under the responsibilities and authorities the plan assigns, including who may accept residual risk.
Set the risk acceptability criteria in the order the standard does: a top-management policy grounded in the regulation and the state of the art, device-specific severity and probability scales with stated units and sources, a two-part probability estimate, a matrix whose acceptable region never excuses practicable reduction, a rule for unestimable probability, and a method for the overall residual risk — because every judgement in the file is measured against them, and a reviewer reads them first.
The risk acceptability policy, the severity and probability scale definitions, the risk matrix template with the overall residual risk method and the risk management plan are in the ISO 14971 Toolkit, or start with the free templates.
September 21, 2026
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026